Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands

Ahold Delhaize, the Dutch multinational grocery chain, said Monday that a cyberattack forced it to take systems offline across most of its U.S. and European brands, impacting shoppers on both sides of the Atlantic.

The company confirmed that the suspicious activity it announced detecting in its IT systems last week was caused by malicious actors, adding that it filed a police report in the Netherlands on Monday.

The incident disrupted online services in the U.S., Netherlands and Belgium, although stores remained open. Although the company said it had no evidence that sensitive customer, employee or partner data was stolen, it cautioned that the investigation into the hack remains ongoing.

It did not describe the nature of the attack, nor whether a ransom was involved, stating: “We are not sharing further details that could compromise security measures or interfere with our response efforts.”

The retailer said it was restoring services in phases, and that online shopping services at U.S. brands — including Food Lion and Stop & Shop — are not yet functional, although they are expected to resume in the coming days. The websites and apps for Dutch brands Albert Heijn, Etos and Gall & Gall are back online, though Albert Heijn home deliveries are not expected to resume until Friday. 

It said e-commerce services have been restored in Belgium and Central and Southeastern Europe.

Chief Executive Officer Frans Muller apologized for the disruption, saying taking systems offline was a necessary precaution. 

“Although this incident was caused by the malicious actions of others, we apologize for the inconvenience this has caused — especially to our customers,” Muller said.

The company said it notified Dutch cybersecurity authorities within 24 hours of detecting the incident.

Ahold Delhaize previously suffered a cyberattack in 2024, causing issues at prominent supermarkets across the U.S. More than 2.2 million people had information stolen from the company’s systems during that incident.